SAA-C03 Q643 · Security

Question

A healthcare company uses an Amazon EMR cluster to process patient data. The data must be encrypted in transit and at rest. Local volumes in the cluster also need to be encrypted. Which solution will meet these requirements?

Accepted Answer

**Answer B** is correct because **EMR security configurations** are the purpose-built mechanism for managing encryption across an entire EMR cluster. Here's how it satisfies each requirement:

1. **Data encrypted at rest**: EMR security configurations allow you to enable encryption for data stored in Amazon S3 (using SSE-S3, SSE-KMS, or CSE-KMS/CSE-Custom) and for data on local disks (HDFS encryption).

2. **Data encrypted in transit**: The security configuration supports enabling in-transit encryption, which uses TLS to encrypt data moving between cluster nodes and between the cluster and S3. It automatically configures open-source encryption features like Hadoop's encrypted shuffle and Spark's TLS settings.

3. **Local volume encryption**: EMR security configurations support **local disk

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips